Joining the ranks of Windows’ users who have been victimized by spoofed security alerts, Linux users this weekend received bogus messages directing them to download updates that are in fact Trojan horses, Red Hat announced Saturday.

The E-mail, which carried the sender address of “security@redhat.com” and an initial subject head of “RedHat: Buffer Overflow in ‘ls’ and ‘mkdir,'” instructs users to download and install a purported patch. In an advisory on its Web site, Red Hat warned that the “patch” is actually a Trojan designed to compromise systems.

“Official messages from the Red Hat security team are never sent unsolicited,” said the company in its advisory, and “are always sent from the address ‘secalert@redhat.com,’ and are digitally signed.”

After the initial spammed wave, said Finnish security firm F-Secure Corp., someone used phony information to register the domain “fedora-redhat.com,” which is very close to “fedora.redhat.com,” the official site of the Fedora Project, a free operating system supported by Red Hat.

The second spam run of Sunday directed recipients to fedora-redhat.com for the fix.

more [url=http://informationweek.com/story/showArticle.jhtml?articleID=51200210]Information Week[/url]

---

Filed under: Security - @ October 26, 2004 3:33 pm